HMRC Says Generative AI in Tax Software Should Support, Not Replace, Human Judgment

On January 28, 2026, the UK's HM Revenue & Customs published "Guidelines for using generative artificial intelligence if you're a software developer." It sets out, in its words, "HMRC's expectations for what good use of generative AI" looks like in commercial software products. These could be, it says, products that help customers with their taxes, "like when submitting tax returns or other information to HMRC."

HMRC recognizes the opportunities that generative AI offers software developers, the guidance says, and "encourages innovative use of AI in tax software products." It "does not endorse or approve any software developer or product," and developers "must not suggest or imply that they are acting on behalf of HMRC." Parts of the guidance follow, not the whole.

Where software products use generative AI, the guidance says, it is expected that they are transparent; consider HMRC guidance and only use reliable source data, which should be in line with the relevant legislation; are designed with human oversight and control; include strong data-security and privacy measures; and are ethical.

Transparency and Reliable Sources

"You are responsible for making sure that any AI model you use when building your software has strong controls, so users are aware that the software is enhanced by generative AI." Developers should be transparent, it says, about how human review is applied to the results from the model, and clearly communicate the capabilities and limitations. Users should be able to identify the source data used, understand how it is processed, understand the limitations of the model and raise issues identified with its results, and be aware of the possibilities of bias and inaccuracies. The guidance gives "hallucinations" as an example of inaccuracies, where the generative AI system "produces information that appears to make sense but is factually incorrect or made up."

HMRC expects any software enhanced by generative AI to "support the production of tax returns and related information" and to "produce results that comply with tax legislation and case law to support users to submit an accurate return." The data sources used by generative AI models are expected to come from materials such as official HMRC publications, legislation and established case law.

HMRC also "expects you to implement strong testing and deployment processes in your software." These should cover "the continuous monitoring, version control and timely updating of the underlying code and all relevant data sources." That, the guidance says, "is essential to reflect changes in tax legislation, case law and HMRC guidance as they happen."

The guidance asks for sources kept up to date as the rules change. Would a user be able to see when the software's sources were last brought up to date?

Human Oversight and Control

Generative AI-enhanced software that helps customers with their tax "should be designed with strong human oversight and control built in at appropriate stages." It "should support, not replace, human judgment." Where needed, the guidance says, it should actively prompt users to check the results themselves, and allow them to correct any errors or raise any issues with the software.

If the software identifies areas involving "nuanced tax rules, complex scenarios or specific guidance," it should clearly flag this to the user, and identify the need to investigate further or recommend seeking advice from a qualified tax professional. The software, it says, "should clearly remind users that it is their responsibility" to make sure each tax return is accurate.

Security, Privacy and Ethics

It is important, the guidance says, that such software includes Secure Software Development Lifecycle best practices: complying with UK General Data Protection Regulations, embedding privacy by design, and building in strong security measures. This matters, in its words, "because some of these tools handle highly sensitive personal, commercial and financial data, and must operate without compromising privacy." Users "should be able to see how their information is processed."

HMRC expects developers of generative AI-enhanced software to operate in a way that "makes sure all software outputs fully comply with legal requirements" and uses diverse and representative training data and, where personal data is involved, makes sure its use is fully compliant with UK General Data Protection Regulations. It expects them to implement "continuous auditing to prevent the development of harmful, biased, or discriminatory models," and to make sure "the AI system is fair and trustworthy, fully accountable, and demonstrably serving the public good."